Presently, malicious network content (e.g., malicious software or malware) can attack various devices via a communication network. For example, malware may include any program or file that is harmful to a computer user, such as bots, computer viruses, worms, Trojan horses, adware, spyware, or any programming that gathers information about a computer user or otherwise operates without permission.
Various processes and devices have been employed to prevent the problems that malicious network content can cause. For example, computers often include antivirus scanning software that scans a particular client device for viruses. Computers may also include spyware and/or adware scanning software. The scanning may be performed manually or based on a schedule specified by a user associated with the particular computer, a system administrator, and so forth. Unfortunately, by the time a virus or spyware is detected by the scanning software, some damage on the particular computer or loss of privacy may have already occurred. Additionally, it can take days or weeks for new Anti-Virus signatures to be manually created and for an anti-virus application to be updated, by which time malware authors will have already created new versions that evade the signatures. Moreover, polymorphic exploits are also an issue that limits the effectiveness of some anti-virus applications.
Malicious network content may be distributed over a network via web sites, e.g., servers operating on a network according to an HTTP standard. Malicious network content distributed in this manner may be actively downloaded and installed on a user's computer, without the approval or knowledge of the user, simply by accessing the web site hosting the malicious network content. The web site hosting the malicious network content may be referred to as a malicious web site. The malicious network content may be embedded within data associated with web pages hosted by the malicious web site. For example, a web page may include JavaScript code, and malicious network content may be embedded within the JavaScript code. In this example, the malicious network content embedded within the JavaScript code may be obfuscated such that it is not apparent until the JavaScript code is executed that the JavaScript code contains malicious network content. Therefore, the malicious network content may attack or infect a user's computer before detection by antivirus software, firewalls, intrusion detection systems, or the like.
Additionally, malicious network content may be distributed by electronic messages, including email, using such protocols as POP, SMTP, IMAP, and various forms of web-based email. Malicious content may be directly attached to the message (for example as a document capable of exploiting a document reading application, such as a malicious Microsoft Excel document). Alternatively, electronic messages may contain URL links to malicious content hosted on web servers elsewhere on the network. When target users click on such links, they may be infected from the web in the manner described above. These techniques for infecting user computers via electronic messages are often used to make targeted attacks on particular “high-value” users at organizations, such as executives or key technical or operational staff.
What is needed is an improved system for detecting malicious content propagated in electronic messages.